Fail2ban – Remote Code Execution

Re:Fail2ban – Remote Code Execution by ranguski on Tuesday September 28, 2021 @02:06AM (#28679789)

Damn, this is amazing. Even as bare access goes. Find is indeed a severity red, unsure who is gonna patch up mailutils

[ Parent | on HN ]

Re:Fail2ban – Remote Code Execution by joeyh on Tuesday September 28, 2021 @08:24AM (#28681961)

I'm going to guess "noone". This is not the first security hole like this caused by piping to mail. See CVE-2000-0703, a trivial local root via suidperl. Unfortunately backwards compatability often wins over prevention of future security holes.

[ Parent | on HN ]